Managing a network infrastructure often entails accounting for user, device, or other identities in order to control access rights (e.g., permissions or authorizations to access certain network resources), user assignments (e.g., applications or policies assigned to a user), or otherwise manage a network based on users. As such, many network implementations incorporate a form of identity management in order to simplify user management processes. For example, identity management solutions often include an authoritative source (e.g., a directory service) that identifies a network's resources, users' rights to access the resources, and application or policy assignments for specific users or devices, among other things. As a network infrastructure grows and changes, however, effective user-based management often becomes difficult, particularly when heterogeneous systems include different authoritative sources or identity management products.
For example, various groups, departments, or other classes of network users or devices may have different requirements resulting in different authoritative sources being implemented within the network. In another example, a network may be upgraded or migrated to a new authoritative source, but an administrator may prefer to manage new users with the new source and preserve a previous authoritative source for existing users. Although there can be many reasons for using multiple authoritative sources, existing systems often cannot provide seamless integration and interoperability among the various authoritative sources. For example, many existing integration efforts focus on use of synchronization modules that dredge authoritative sources, discover users, and build a searchable database. This type of system suffers from various drawbacks, including a lack of a consistent way to create identity-aware applications, while shielding programmers from underlying differences in the authoritative sources. Moreover, synchronization modules may only search authoritative sources at periodic intervals; or upon request, or in other ways that do not provide real-time integration and interoperability. As such, users requiring immediate access to resources may be restricted from accessing critical resources until completion of the synchronization process, potentially causing unnecessary delays, or decreases in productivity, among other problems.
Existing systems suffer from these and other problems.